Standard database | Specifications | DNS Database Download | WhoisXML API
Products APIs Data Feeds Web Tools Domain Research & Monitoring Enterprise Packages
WHOIS / WHOIS History
WHOIS / WHOIS History

Provide current and historical ownership information on domains / IPs. Identify all connections between domains, registrants, registrars, and DNS servers.

DNS / DNS History
DNS / DNS History

Look into all current and historical DNS / IP connections between domains and A, MX, NS, and other records. Monitor suspicious changes to DNS records.

IP Geolocation / IP Netblocks
IP Geolocation / IP Netblocks

Get detailed context on an IP address, including its user’s geolocation, time zone, connected domains, connection type, IP range, ASN, and other network ownership details.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Access our web-based solution to dig into and monitor all domain events of interest.

Domain Research Suite (DRS)
Domain Research Suite (DRS)

Get access to a web-based enterprise-grade solution to search and monitor domain registrations and ownership details for branded terms, fuzzy matches, registrants of interest, and more.

Research
Monitoring
White-Label
WhoisXML API Predictive Threat Intelligence
Predictive Threat Intelligence

Detect and block access to and from dangerous domain names before malicious actors can weaponize them. Contact us today for more information.

WhoisXML API Internet Infrastructure
Internet Infrastructure

Unlock integrated intelligence on Internet properties and their ownership, infrastructure, and other attributes.

Enterprise API Packages
Enterprise API Packages

Our complete set of domain, IP, and DNS intelligence available via API calls as an annual subscription with predictable pricing.

Security Intelligence (SI) Suite
Security Intelligence (SI) Suite

Offers complete access to WHOIS, IP, DNS, and subdomain data for product enrichment, threat hunting and more.

Multi-Level API User Administration Now Available - Manage individual API keys for team members in your organization.

Learn More
×
Contact Us
Specifications Pricing Blog
FAQ - Premium database - Standard database

Standard database

Samples

The database comes in five forms, which include A, AAAA, MX, NS, TXT, CNAME, SOA, and PTR records and can be downloaded in CSV. The Standard DNS Database offers current DNS records.

Subscription type Description
Daily updates Include DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) that have been added during a previous day for a given date in unified and consistent CSV format. These files are located in the daily_datafeed subdirectory and are named in format:
- "daily_datafeed/dns_database.%DATE%.daily.csv.gz"
- "daily_datafeed/dns_aaaa_database.%DATE%.daily.csv.gz"
- "daily_datafeed/dns_mx_database.%DATE%.daily.csv.gz"
- "daily_datafeed/dns_ns_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_txt_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_cname_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_soa_database.%DATE%.daily.csv.gz",
- "daily_datafeed/dns_ptr_database.%DATE%.daily.csv.gz",
e.g. "daily_datafeed/dns_database.2021-12-01.daily.csv.gz".
Weekly updates Include changes in the weekly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous week. These files are named in format:
- "dns_database.%DATE%.weekly.diff.csv.gz"
- "dns_aaaa_database.%DATE%.weekly.diff.csv.gz"
- "dns_mx_database.%DATE%.weekly.diff.csv.gz",
- "dns_ns_database.%DATE%.weekly.diff.csv.gz",
- "dns_txt_database.%DATE%.weekly.diff.csv.gz",
- "dns_cname_database.%DATE%.weekly.diff.csv.gz",
- "dns_soa_database.%DATE%.weekly.diff.csv.gz",
- "dns_ptr_database.%DATE%.weekly.diff.csv.gz",
e.g. "dns_database.2021-12-01.weekly.diff.csv.gz".
Monthly updates Include changes in the weekly full database of DNS records compared to the previous period. Includes added, dropped, and modified records since the previous month. These files are named in format:
- "dns_database.%DATE%.monthly.diff.csv.gz"
- "dns_aaaa_database.%DATE%.monthly.diff.csv.gz"
- "dns_mx_database.%DATE%.monthly.diff.csv.gz",
- "dns_ns_database.%DATE%.monthly.diff.csv.gz",
- "dns_txt_database.%DATE%.monthly.diff.csv.gz",
- "dns_cname_database.%DATE%.monthly.diff.csv.gz",
- "dns_soa_database.%DATE%.monthly.diff.csv.gz",
- "dns_ptr_database.%DATE%.monthly.diff.csv.gz",
e.g. "dns_database.2021-12-01.monthly.diff.csv.gz".
Weekly Full database A weekly full database of DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, PTR) collected for the previous 90 days before a given date in a unified and consistent CSV format. These files are named in format:
- "dns_database.%DATE%.full.csv.gz"
- "dns_aaaa_database.%DATE%.full.csv.gz"
- "dns_mx_database.%DATE%.full.csv.gz"
- "dns_ns_database.%DATE%.full.csv.gz",
- "dns_txt_database.%DATE%.full.csv.gz",
- "dns_cname_database.%DATE%.full.csv.gz",
- "dns_soa_database.%DATE%.full.csv.gz",
- "dns_ptr_database.%DATE%.full.csv.gz",
e.g. "dns_database.2021-12-01.full.csv.gz".
Lite database A partial database of A DNS records for a given date made for academic purposes. It includes about 5% of a weekly full database. These files are named in format:
- "dns_database.%DATE%.academic.csv.gz"
e.g. "dns_database.2021-12-01.academic.csv.gz".


Note that the weekly and monthly data are derived from the concatenation of the respective daily data and the addition of the first field, the date.

Downloading via FTP

When dealing with extensive data sets, factors such as download speed, round-trip times, network stability, and disk I/O can influence the successful completion of your download over the HTTP protocol. Additionally, external elements like antivirus software may introduce complexities that hinder the seamless transfer of your data. To ensure a smoother and more reliable download experience, we highly recommend utilizing the FTP (File Transfer Protocol) option whenever possible. FTP provides a robust solution that minimizes the impact of potential challenges associated with HTTP downloads. If you encounter download errors or face any difficulties, we encourage you to reach out to our dedicated support department. They will be more than happy to assist you in enabling FTP access, thereby optimizing your data transfer process.

Downloading via HTTPS

Downloading via FTPS

Read more about the FTPS connection: https://en.wikipedia.org/wiki/FTPS.

Our FTP server supports explicit FTP over TLS encryption. You may configure your FTP client to use explicit FTP over TLS encryption for secure communications.

Our FTPS server is accessed using the same paths and API keys as a regular FTP server, the instructions for which are described above. To connect via FTPS, select the "Require explicit FTP over TLS" encryption option in your FTP client, if it supports it. FileZilla configuration example:

explicit FTP over TLS encryption

Average file sizes

Measured as of 18 October 2024.

A files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Partial database for academic purposes .academic 852.1MB 3.4GB 71.4M
Weekly full database export .full 14.3GB 68.4GB 1.4B
Weekly changes in the full database .weekly.diff 436.3MB 1.7GB 39.7M
Monthly changes in the full database .monthly.diff 2.2GB 8.7GB 204M
Records added during the previous day .daily 134.2MB 512.8MB 12.7M

MX files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 4.1GB 23.9GB 417.9M
Weekly changes in the full database .weekly.diff 65.9MB 383MB 6.1M
Monthly changes in the full database .monthly.diff 370.3MB 2.1GB 34.8M
Records added during the previous day .daily 53.4MB 331.3MB 5.5M

NS files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 7.5GB 47.6GB 0.9B
Weekly changes in the full database .weekly.diff 113.4MB 675MB 12.7M
Monthly changes in the full database .monthly.diff 656.6MB 4.1GB 78.9M
Records added during the previous day .daily 97.1MB 631MB 11.8M

TXT files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 5.8GB 21.8GB 278M
Weekly changes in the full database .weekly.diff 117.1MB 445.5MB 5.5M
Monthly changes in the full database .monthly.diff 677.8MB 3.0GB 36.2M
Records added during the previous day .daily 79.8MB 287.7MB 3.5M

CNAME files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 1.3GB 5.7GB 74.2M
Weekly changes in the full database .weekly.diff 143.3MB 692.0MB 7.9M
Monthly changes in the full database .monthly.diff 671.9MB 3.2GB 36.9M
Records added during the previous day .daily 25.2MB 122.0MB 1.5M

SOA files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 7.9GB 39.9GB 371.4M
Weekly changes in the full database .weekly.diff 225.1MB 1.1GB 10.1M
Monthly changes in the full database .monthly.diff 1.2GB 6.0GB 55.5M
Records added during the previous day .daily 103.1MB 512.4MB 4.7M

AAAA files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 1.8GB 7.3GB 151.5M
Weekly changes in the full database .weekly.diff 65.5MB 267.0MB 5.1M
Monthly changes in the full database .monthly.diff 354.1MB 1.5GB 28.9M
Records added during the previous day .daily 20.6MB 79.2MB 1.6M

PTR files

File content Filename suffix Avg. gzipped file size Avg. unpacked file size Avg. number of records
Weekly full database export .full 4.5GB 29.6GB 479M
Weekly changes in the full database .weekly.diff 23.2MB 117MB 1.9M
Monthly changes in the full database .monthly.diff 120.1MB 648.1MB 10.5M
Records added during the previous day .daily 11.7MB 49.0MB 862.8K

CSV output structure and fields' descriptions

The database files are comma-separated value-files without text delimiters. The files use DOS/Windows - style line terminators (CR+LF). The first line is a header line with the field names. Each line has four or five fields depending on the subscription type:

A files

  • Structure: <DOMAIN>,<LAST_UPDATE_TIMESTAMP>,<IP1> <IP2> ... <IPn>,<WILDCARD>,<ACTIVE>
  • Example: 0--r.nom.za,1727012161,127.0.0.1,,true
DOMAIN
Domain or subdomain name.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
IP1, IP2, IPn
List of IPs associated with the domain, separated by space.
WILDCARD
Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

AAAA files

  • Structure: <DOMAIN>,<LAST_UPDATE_TIMESTAMP>,<IP1> <IP2> ... <IPn>,<WILDCARD>,<ACTIVE>
  • Example: 0--f.blogspot.hr,1726563076,2607:f8b0:4006:81f::2001,,true
DOMAIN
Domain or subdomain name.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record. If there is more than one IP address, the timestamp corresponds to all of them.
IP1, IP2, IPn
List of IPs associated with the domain, separated by space.
WILDCARD
Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

MX files

  • Structure:
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<PRIORITY>,<MX1>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<PRIORITY>,<MX2>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<PRIORITY>,<MX1>,<WILDCARD>,<ACTIVE>
    - ...
  • Example:
    - 0-0.im,1725900527,65,route1.mx.cloudflare.net,,true
    - 0-0.io,1725184548,10,mail.0-0.io,,true
DOMAIN
Domain or subdomain name.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record.
PRIORITY
Priority identifies which mailserver should be preferred.
MX
The MX record associated with the domain.
WILDCARD
Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

NS files

  • Structure:
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<NS1>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<NS2>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<NS1>,<WILDCARD>,<ACTIVE>
    - ...
  • Example:
    - 0--1.net,1725227715,dns02.muumuu-domain.com,,true
    - 0--n.com,1727465160,ns1.bluehost.com,,true
DOMAIN
Domain or subdomain name.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record.
NS
The NS record associated with the domain.
WILDCARD
Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

TXT files

  • Structure:
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<TXT1>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<TXT2>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<TXT1>,<WILDCARD>,<ACTIVE>
    - ...
  • Example:
    - 0--1.net,1725227715,v=spf1 include:_spf.heteml.jp ~all,,true
    - 0--n.com,1727465160,v=spf1 +a +mx +ip4:69.195.124.50 ?all,,true
DOMAIN
Domain or subdomain name.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record.
TXT
The TXT record associated with the domain.
WILDCARD
Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

CNAME files

  • Structure:
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<CNAME1>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<CNAME2>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<CNAME1>,<WILDCARD>,<ACTIVE>
    - ...
  • Example:
    - 0--6.hb.cldmail.ru,1724661484,hb.cldmail.ru,,true
    - 0--f.blogspot.hr,1726563076,blogspot.l.googleusercontent.com,,true
DOMAIN
Domain or subdomain name.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record.
CNAME
The CNAME record associated with the domain.
WILDCARD
Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

SOA files

  • Structure:
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<SOA1>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-A>,<LAST_UPDATE_TIMESTAMP>,<SOA2>,<WILDCARD>,<ACTIVE>
    - <DOMAIN-B>,<LAST_UPDATE_TIMESTAMP>,<SOA1>,<WILDCARD>,<ACTIVE>
    - ...
  • Example:
    - 0--1.net,1725227715,dns01.muumuu-domain.com. postmaster.0--1.net. 1724718394 3600 1800 604800 3600,,true
    - 0--n.com,1727465160,ns1.bluehost.com. root.box2438.bluehost.com. 2020120802 86400 7200 3600000 300,,true
DOMAIN
Domain or subdomain name.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record.
SOA
The SOA record associated with the domain.
WILDCARD
Shows if DNS record is part of a wildcard entry (true: under wildcard, false: not under wildcard, empty: not yet checked).
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).

PTR files

  • Structure:
    - <IP-A>,<LAST_UPDATE_TIMESTAMP>,<PTR1>,<WILDCARD>,<ACTIVE>
    - <IP-A>,<LAST_UPDATE_TIMESTAMP>,<PTR2>,<WILDCARD>,<ACTIVE>
    - <IP-B>,<LAST_UPDATE_TIMESTAMP>,<PTR1>,<WILDCARD>,<ACTIVE>
    - ...
  • Example:
    - 1.0.100.10,1723329288,10.100.0.1.megaegg.ne.jp,,
    - 1.0.100.104,1722985502,104.100.0.1.megaegg.ne.jp,,
IP
IP address.
LAST_UPDATE
UNIX timestamp of the last visit/update on current record.
PTR
The PTR record associated with the IP.
WILDCARD
PTR files datafeed contains a wildcard field for parsing compatibility, it's always empty.
ACTIVE
Indicates domain last resolution status (true: successful, false: failed, empty: third-party record not yet resolved).